Recent trends in CTI sharing have seen many notable developments towards automation, both in its generation (as discussed above) as well as in its consumption. For example, technologies such as Structured Threat Information Expression (STIX) and Trusted Automated eXchange of Intelligence Information (TAXII), has allowed many organisations to easily share and consume CTI in an automated way [1]}. As CTI consumption becomes more automated, it could be feasible for threat actors to utilize this to create new attack surfaces. For example, intelligence structured using STIX can contain SNORT rules that consumers can automatically feed into their intrusion detection systems (IDS) [2]}. Given certain conditions, we theorise that it could be plausible for an attacker to construct seemingly legitimate intelligence that causes a consuming organisations IDS to flag legitimate activity as malicious. This technique could be used in conjunction with an actual attack, to disguise malicious activity amongst legitimate traffic that is falsely flagged as suspicious.
